In the literature, there are a variety of data recovery methods, among which DLG [1]} is able to achieve exact pixel-wise level data revealing. In this work, we consider the server malicious, and it utilizes DLG to recover original data from a victim client. We evaluate the privacy-preserving capability of FedCG by comparing the quality of image data recovered in FedCG, FedAvg and FedSplit. FedAvg is the representative of FL methods that share the full classification network while FedSplit represents FL methods that share only the public classifier. (REF ) shows the DLG loss \(\mathcal {L}^{dlg}\)  for the malicious server recovering the real data of victim client \(i\) .
\(\mathcal {L}^{dlg} = ||\nabla _\theta \mathcal {L}^{cls}(x_i) - \nabla _\theta \mathcal {L}^{cls}(\tilde{x}) ||^2\) 
